pub-feb99a8e8a744872bd5d9a7a88924454[.]r2[.]dev

This domain was identified as a credential harvesting phishing site targeting users of cloud storage services. The infrastructure was designed to impersonate legitimate login portals, likely using cloned interfaces to trick victims into submitting authentication details. Analysis of the page source and redirect behavior suggests the site was engineered to capture usernames, passwords, and potentially multi-factor authentication codes before relaying them to attacker-controlled endpoints. The domain's short operational window and immediate takedown indicate a targeted campaign rather than a persistent threat. Technical indicators confirm the domain's malicious nature. The domain pub-feb99a8e8a744872bd5d9a7a88924454.r2.dev was created on April 29, 2026, and registered through Cloudflare R2, a platform frequently abused for hosting phishing content due to its low-cost object storage and CDN capabilities. VirusTotal records show 18 out of 95 security vendors flagged the domain as malicious, while it appears on four security blocklists, including PhishDestroy and PhishingArmy. The domain resolved to IP address 104.18.50.34, a Cloudflare IP range, and employed a Let's Encrypt SSL certificate to create a false sense of legitimacy. Google Safe Browsing classified the site under SOCIAL_ENGINEERING, and Gridinsoft assigned a trust score of 0/100, further validating its high-risk status. Users who visited this domain or entered credentials should assume their login details were compromised. Immediate action is required: reset passwords for any accounts accessed through the site, enable multi-factor authentication where available, and review account activity for unauthorized access. Monitor financial and cloud storage accounts for suspicious transactions or file modifications. If the same credentials were reused across multiple services, update those passwords as well. Organizations should block the domain and its resolving IP (104.18.50.34) at the network level to prevent further exposure. Security teams are advised to search logs for connections to the domain and investigate potential lateral movement or data exfiltration linked to compromised credentials.